On June 10, 2020, Bill No. 1,179 of 2020—now Law No. 14,010 of 2020—confirmed the validity of articles 52, 53 and 54 of the Brazilian General Law for the Protection of Personal Data ("LGPD") as of August 1, 2021. These articles provide the administrative sanctions that the National Data Protection Authority ("ANPD") may apply to data processing agents (controller and operator) for violations of the LGPD.
However, Law No. 14,010 of 2020 does not affect the other articles of the LGPD that, as of now, are set to enter into force on May 3, 2021, according to Provisional Measure No. 959/2020. And until the National Congress rejects, approves or changes this provisional measure, or even if it expires on August 27, 2020, the future of the LGPD remains uncertain.
It is important to note that, also on June 10, 2020, several Brazilian trade and industrial associations (agriculture and livestock; trade in goods, services and tourism; industry; financial institutions; health; general insurance, private pension and life, supplementary health and capitalization-CNseg; transportation; and the COB system) sent a letter to the President of the Brazilian Chamber of Deputies asking for the approval of Provisional Measure No. 959/2020 so that the rest of the LGPD will enter into force no sooner than May 2021. These trade and industrial associations, which represent a good portion of the Brazilian economy, base that position on the fact that the ANPD has yet to be formed and say that the ANPD being operational would be essential to companies' ability to comply with LGPD standards—and they note that Brazilian companies need to focus now on recovering from the effects of the pandemic, with almost all having had their operations severely impacted by COVID-19.
It is essential to point out that articles 55-A to 55-L, 58-A and 58-B of the LGPD, which create and regulate the ANPD, have been in full force since December 28, 2018.
Finally, the entry into force of the sanctions, which are of a purely administrative nature, would not preclude other actions to enforce the LGPD. The data subjects and several public consumer protection authorities, public authorities for the regulation of specific fields (the Central Bank, the Health Surveillance Agency, the Telecoms Agency, the Film Agency, etc.), public prosecutors, and public defenders, as well as private associations, may use the LGPD as grounds to file lawsuits against the data controllers, claiming the improper treatment of personal data. In this sense, even if the administrative sanctions are not to take effect until August 2021, companies should plan to be in compliance with all LGPD rules by no later than May 3, 2021.
Visit us at Tauil & Chequer
Founded in 2001, Tauil & Chequer Advogados is a full service law firm with approximately 90 lawyers and offices in Rio de Janeiro, São Paulo and Vitória. T&C represents local and international businesses on their domestic and cross-border activities and offers clients the full range of legal services including: corporate and M&A; debt and equity capital markets; banking and finance; employment and benefits; environmental; intellectual property; litigation and dispute resolution; restructuring, bankruptcy and insolvency; tax; and real estate. The firm has a particularly strong and longstanding presence in the energy, oil and gas and infrastructure industries as well as with pension and investment funds. In December 2009, T&C entered into an agreement to operate in association with Mayer Brown LLP and become "Tauil & Chequer Advogados in association with Mayer Brown LLP."
© Copyright 2020. Tauil & Chequer Advogados, a Brazilian law partnership with which Mayer Brown is associated. All rights reserved.
This article provides information and comments on legal issues and developments of interest. The foregoing is not a comprehensive treatment of the subject matter covered and is not intended to provide legal advice. Readers should seek specific legal advice before taking any action with respect to the matters discussed herein.
